mcc0nnell opened a new pull request, #597: URL: https://github.com/apache/maven-apache-parent/pull/597
Fixes #360 Publish CycloneDX SBOMs for ASF Maven releases by configuring cyclonedx-maven-plugin in the existing apache-release profile. This: * uses CycloneDX Maven Plugin 2.9.3 * runs makeAggregateBom during package * excludes test scope using the plugin defaults * attaches both JSON and XML SBOMs with the cyclonedx classifier, so they are published by the normal Maven deploy flow * affects release builds only; ordinary builds are unchanged This follows the approach already used by apache/maven-parent for MPOM-346, extending the capability to projects inheriting directly from the ASF parent POM. The parent POM documentation is updated to describe the generated release artifacts. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
